DFIRHub

ExchangeCve-2021-26855

Exchange Server Vulnerability *.Compiled Files

  • Windows
  • 4 paths
  • Regex:*.\b[a-zA-Z0-9_-]{8}\b.compiled
  • Version 1
  • Dennis Reneau

Paths on disk

4 paths

Notes

Microsoft Exchange CVE-2021-26855

Identified *.compound files are modified XML files associated with malicious dll's.

Query for WebShell IOC's with randomized 8 character names preceding the .compiled file extension.

References

1 link